# The database for www.renner.uno. Named `wordpress-mariadb`, not `wp-*`:
# `wp-pg` in the woodpecker namespace is Woodpecker's Postgres, and reusing
# the prefix for an unrelated engine invites exactly the wrong guess.
#
# Mirrors the CNPG convention: the operator lives in `database`, the database
# resource lives with its consumer (ak-pg in authentik, im-pg in immich).
apiVersion: k8s.mariadb.com/v1alpha1
kind: MariaDB
metadata:
  name: wordpress-mariadb
  namespace: wordpress
  annotations:
    # Data guard — a Kustomization rebuild must never take the database with it.
    kustomize.toolkit.fluxcd.io/prune: disabled
spec:
  # generate: true lets the operator create both Secrets on first reconcile.
  # Neither password is ever typed by a human or parked in OpenBao, so there
  # is nothing to rotate by hand and nothing to leak through Git.
  rootPasswordSecretKeyRef:
    name: wordpress-mariadb-root
    key: password
    generate: true
  username: wordpress
  passwordSecretKeyRef:
    name: wordpress-mariadb-app
    key: password
    generate: true
  database: wordpress
  port: 3306
  replicas: 1

  storage:
    size: 5Gi
    storageClassName: ceph-block
  # The source database is 527 KB. 5Gi is not a sizing estimate, it is the
  # smallest allocation that leaves room for binlogs and a decade of posts.

  myCnf: |
    [mariadb]
    bind-address=*
    default_storage_engine=InnoDB
    innodb_buffer_pool_size=256M
    # WordPress writes utf8mb4 throughout; the source dump carries
    # utf8mb4_unicode_520_ci on every table that survives the migration.
    character_set_server=utf8mb4
    collation_server=utf8mb4_unicode_520_ci
    max_allowed_packet=64M

  resources:
    requests:
      cpu: 100m
      memory: 512Mi
    limits:
      memory: 1Gi
---
# Logical backup to Hetzner Object Storage. Velero only captures PVC data,
# which for a running database is crash-consistent, not transaction-consistent
# — that is a snapshot, not a backup you would want to restore from.
apiVersion: k8s.mariadb.com/v1alpha1
kind: Backup
metadata:
  name: wordpress-mariadb-backup
  namespace: wordpress
spec:
  mariaDbRef:
    name: wordpress-mariadb
  schedule:
    # 02:45, ahead of the Velero window that starts at 03:15.
    cron: "45 2 * * *"
    suspend: false
  maxRetention: 720h # 30d, matching the CNPG ObjectStore retentionPolicy
  compression: gzip
  storage:
    s3:
      bucket: renner-uno-k8s-mariadb
      prefix: wordpress
      endpoint: fsn1.your-objectstorage.com
      region: fsn1
      accessKeyIdSecretKeyRef:
        name: hetzner-s3-creds
        key: ACCESS_KEY_ID
      secretAccessKeySecretKeyRef:
        name: hetzner-s3-creds
        key: ACCESS_SECRET_KEY
      tls:
        enabled: true